Privacy policy
Last updated: October 2026. This English version is provided for convenience; in case of discrepancy, the Spanish version prevails.
1. Data controller
- Controller: Black Mamba Systems SL
- Email: info@positrom.com
- Website: https://positrom.com
2. Data we process
- Registration: email address and password (stored as a hash).
- Billing (only when subscribing): full name or company name, account type, tax ID type and number (NIF, NIE, CIF, VAT or passport) and address.
- Free trial: start and end dates, tokens used, a normalised version of the email and a hash of the sign-up IP, used only to prevent duplicate trials.
- Account: role, status, sign-up and last access dates, and acceptance of the legal texts.
- Marketing: only if you tick the optional news box.
- Subscription and payments: plan status, Mollie identifiers, amounts and payment dates. We never store the full card number.
- Chat and usage: conversations, messages and usage measurement.
- Technical: HMAC hash of the visit IP, user agent, visited path, session cookies and chosen language.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Account creation and free trial management | Performance of a contract (art. 6.1.b GDPR) |
| Invoicing, payment mandate and tax/accounting obligations | Contract and legal obligation (art. 6.1.b and 6.1.c) |
| Providing the AI chat and managing included usage | Performance of a contract |
| Account notices and support | Performance of a contract |
| Security, fraud prevention, duplicate trials and AI misuse | Legitimate interest (art. 6.1.f) |
| Marketing news | Consent (art. 6.1.a), which you can withdraw at any time |
4. Recipients and processors
We do not sell personal data. Only where necessary, the following may access it:
- Mollie B.V., payment platform and subscription mandates.
- The AI model provider, which receives the message text to generate the answer. Details in the AI notice.
- Hosting, email and technical maintenance providers, bound by confidentiality.
- Public authorities where required by law.
If a provider processes data outside the European Economic Area, the safeguards of Chapter V of the GDPR will apply.
5. Retention
- Account and billing data: while the relationship is active and then for the time needed for claims.
- Invoicing: legal commercial and tax periods (generally up to 6 years).
- Conversations: while the account exists; after closure, deleted or anonymised within a reasonable time unless legally blocked.
- Technical logs and IP hashes: limited periods for security and auditing.
- Marketing consent: until withdrawn.
6. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to info@positrom.com, proving your identity. You can also complain to the Spanish Data Protection Agency (AEPD).
There is no automated decision with legal effects based solely on the chat. The usage limit is a contractual rule, not a credit profile.
7. Security
We use HTTPS, password hashing, CSRF protection, prepared queries, role control, secrets kept out of the code repository and storage of the visit IP only as an HMAC hash.
8. Minors
The service is intended for people aged 18 or over. If we detect a minor's account, we will close it and delete the associated data.
9. Cookies
We use technical session (positrom_sess) and language (positrom_lang) cookies, and first-party analytics cookies (pt_sid, pt_vid). Details are in the cookie policy.
10. Updates
The version in force is the one published on this page, with the date shown above.